xDown
xDown is malware associated with the suspected Chinese-speaking threat actor IndigoZebra. Kaspersky’s 2017 reporting on IndigoZebra described a covert operation targeting former Soviet republics and associated the activity with malware including Meterpreter, Poison Ivy RAT, xDown, and xCaon. Check Point later referenced that same Kaspersky reporting while describing IndigoZebra espionage activity against political and government targets in Central Asia and Afghanistan. Based on the provided content, xDown is linked to IndigoZebra operations, but the specific capabilities, infection vector, command-and-control method, and indicators of compromise for xDown are not provided in the source material. High-confidence context indicates IndigoZebra targeted political entities and government organizations, including activity in Kyrgyzstan, Uzbekistan, and the Afghan government.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...a wide swath of malware such as Meterpreter, Poison Ivy RAT, xDown..."
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware referenced as part of IndigoZebra’s historical toolset; specific functionality not described in the provided content.
Malware used in the IndigoZebra campaign; no further functional detail provided in the content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.